craftcms/cms vulnerabilities
Craft CMS
- Registry
- Composer
- Latest
- 5.11.5.1
- License
- proprietary
127 known advisories
The latest version, 5.11.5.1, is not affected by any of them. Projects on older versions may be.
composer require craftcms/cms:^5.11.5.1Security advisories for craftcms/cms
Craft CMS: Passkey login accepts replayed WebAuthn assertions
- Affected
- >=5.0.0-RC1 <5.10.5
- Fixed in
- 5.10.5
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated leak of secret environment variables
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
- Affected
- >=5.0.0-RC1 <5.10.6
- Fixed in
- 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Stored XSS in the control panel via unescaped draft name
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Arbitrary user password reset leading to administrator account takeover
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Authenticated RCE through Twig sandbox escape
- Affected
- >=5.0.0-RC1 <5.10.7 · >=4.0.0-RC1 <4.18.3
- Fixed in
- 4.18.3, 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
- Affected
- >=5.5.0 <5.9.14
- Fixed in
- 5.9.14
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
- Affected
- >=4.0.0-RC1 <4.17.7 · >=5.0.0-RC1 <5.9.13
- Fixed in
- 4.17.7, 5.9.13
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
- Affected
- >=5.9.0 <5.10.0
- Fixed in
- 5.10.0
Craft CMS: Stored XSS via Structure entry title in table view
- Affected
- >=5.0.0-RC1 <5.9.53
- Fixed in
- 5.9.53
Craft CMS: Sensitive File Disclosure / Server-Side File Read
- Affected
- >=4.0.0-RC1 <4.18.0 · >=5.0.0-RC1 <5.10.0
- Fixed in
- 4.18.0, 5.10.0
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- Affected
- >=5.0.0-RC1 <5.9.23 · >=4.0.0-RC1 <4.17.16
- Fixed in
- 4.17.16, 5.9.23
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
- Affected
- >=5.7.0 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- Affected
- >=5.0.0-RC1 <5.9.22 · >=4.0.0-RC1 <4.17.15
- Fixed in
- 4.17.15, 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
- Affected
- >=5.0.0-RC1 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
- Affected
- >=5.0.0-RC1 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Affected
- >=5.0.0-RC1 <5.10 · >=4.0.0-RC1 <4.18
- Fixed in
- 4.18, 5.10
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
- Affected
- >=5.0.0-RC1 <5.9.18
- Fixed in
- 5.9.18
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=4.0.0 <4.17.12 · >=5.0.0 <5.9.18
- Fixed in
- 4.17.12, 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- Affected
- >=5.0.0 <5.9.18 · >=4.0.0 <4.17.12
- Fixed in
- 4.17.12, 5.9.18
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
- Affected
- >=5.6.0 <5.9.15
- Fixed in
- 5.9.15
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
- Affected
- >=5.3.0 <5.9.14
- Fixed in
- 5.9.14
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=5.6.0 <5.9.13
- Fixed in
- 5.9.13
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
- Affected
- >=5.9.0-beta.1 <5.9.11
- Fixed in
- 5.9.11
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- Affected
- >=4.0.0-RC1 <4.17.6 · >=5.0.0-RC1 <5.9.12
- Fixed in
- 4.17.6, 5.9.12
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
- Affected
- >=5.6.0 <5.9.11
- Fixed in
- 5.9.11
Craft CMS has a Path Traversal Vulnerability in AssetsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
- Affected
- >=5.0.0-RC1 <5.8.22
- Fixed in
- 5.8.22
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Affected
- >=5.0.0-RC1 <5.9.9 · >=4.0.0-beta.1 <4.17.4
- Fixed in
- 4.17.4, 5.9.9
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
- Affected
- >=5.0.0-RC1 <5.9.9
- Fixed in
- 5.9.9
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
- Affected
- >=4.15.3 <4.17.3 · >=5.7.5 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has a potential information disclosure vulnerability in preview tokens
- Affected
- >=4.0.0-RC1 <4.17.3 · >=5.0.0-RC1 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has unauthenticated activation email trigger with potential user enumeration
- Affected
- >=5.0.0-RC1 <5.9.0-beta.2 · >=4.0.0-RC1 <4.17.0-beta.2
- Fixed in
- 4.17.0-beta.2, 5.9.0-beta.2
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Twig Function Blocklist Bypass
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS: Entries Authorship Spoofing via Mass Assignment
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has IDOR via GraphQL @parseRefs
- Affected
- >=4.0.0-RC1 <4.17.0-beta.1 · >=5.0.0-RC1 <5.9.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
- Affected
- >=5.8.7 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
- Affected
- >=4.5.0-beta.1 <4.16.19 · >=5.0.0-RC1 <5.8.23
- Fixed in
- 4.16.19, 5.8.23
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
- Affected
- >=4.5.0-RC1 <4.16.19 · >=5.0.0-RC1 <5.8.23
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
- Affected
- >=4.5.0-RC1 <4.16.19 · >=5.0.0-RC1 <5.8.23
- Fixed in
- 4.16.19, 5.8.23
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS: GraphQL Asset Mutation Privilege Escalation
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to Stored XSS in Entry Types Name
- Affected
- >=5.0.0-RC1 <5.8.22
- Fixed in
- 5.8.22
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Unauthenticated Craft CMS users can trigger a database backup
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.0.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.5.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS Potential Remote Code Execution via Twig SSTI
- Affected
- >=4.0.0-RC1 <4.16.6 · >=5.0.0-RC1 <5.8.7
- Fixed in
- 4.16.6, 5.8.7
Craft CMS has a theoretical bypass for CVE-2025-23209
- Affected
- >=4.13.8 <4.16.3 · >=5.5.8 <5.8.4
- Fixed in
- 4.16.3, 5.8.4
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- Affected
- >=5.0.0-alpha.1 <5.7.5 · <4.15.3
- Fixed in
- 4.15.3, 5.7.5
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
- Affected
- >=4.0.0-RC1 <4.14.13 · >=5.0.0-RC1 <5.6.15
- Fixed in
- 4.14.13, 5.6.15
Craft CMS Allows Remote Code Execution
- Affected
- >=3.0.0-RC1 <3.9.15 · >=4.0.0-RC1 <4.14.15 · >=5.0.0-RC1 <5.6.17
- Fixed in
- 3.9.15, 4.14.15, 5.6.17
Craft CMS has a potential RCE with a compromised security key
- Affected
- >=5.0.0-RC1 <5.5.8 · >=4.0.0-RC1 <4.13.8
- Fixed in
- 4.13.8, 5.5.8
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
- Affected
- >=5.0.0-RC1 <5.5.2 · >=4.0.0-RC1 <4.13.2 · >=3.0.0 <3.9.14
- Fixed in
- 3.9.14, 4.13.2, 5.5.2
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
- Affected
- >=4.0.0-RC1 <4.12.2 · >=5.0.0-RC1 <5.4.3
- Fixed in
- 4.12.2, 5.4.3
Craft CMS Arbitrary System File Read
- Affected
- >=5.0.0-alpha.1 <5.4.9 · >=3.5.13 <4.12.8
- Fixed in
- 4.12.8, 5.4.9
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
- Affected
- >=5.0.0-RC1 <5.4.6 · >=4.0.0-RC1 <4.12.5
- Fixed in
- 4.12.5, 5.4.6
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
- Affected
- >=5.0.0 <5.1.2
- Fixed in
- 5.1.2
Craft CMS Allows TOTP Token To Stay Valid After Use
- Affected
- >=5.0.0-beta.1 <5.2.3
- Fixed in
- 5.2.3
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
- Affected
- <=3.7.31
- Fixed in
- No fix released
Craft CMS Feed-Me
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Craft CMS Privilege Escalation
- Affected
- >=4.0.0-RC1 <4.5.11 · >=3.0.0 <3.9.6
- Fixed in
- 3.9.6, 4.5.11
Craft CMS Remote Code Execution vulnerability
- Affected
- >=4.0.0-RC1 <4.4.15
- Fixed in
- 4.4.15
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- Affected
- >=4.0.0-RC1 <4.4.15 · >=3.0.0 <3.8.15
- Fixed in
- 3.8.15, 4.4.15
Craft CMS vulnerable to HTML injection
- Affected
- <=4.4.9
- Fixed in
- No fix released
Stored cross site scripting in Craft CMS
- Affected
- >=4.0.0-RC1 <4.4.12
- Fixed in
- 4.4.12
Craft CMS stored XSS in indexedVolumes
- Affected
- >=4.0.0-RC1 <4.4.6
- Fixed in
- 4.4.6
Craft CMS stored XSS in review volume
- Affected
- >=4.0.0-RC1 <4.4.7
- Fixed in
- 4.4.7
Craft CMS XSS in RSS widget feed
- Affected
- >=4.3.0 <4.4.6
- Fixed in
- 4.4.6
CraftCMS stored XSS in Quick Post widget error message
- Affected
- >=4.0.0-RC1 <4.4.6 · >=3.0.0 <3.8.6
- Fixed in
- 3.8.6, 4.4.6
Craft CMS vulnerable to Remote Code Execution via unrestricted file extension
- Affected
- >=4.0.0 <4.4.6
- Fixed in
- 4.4.6
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
- Affected
- <=3.8.1
- Fixed in
- No fix released
craftcms/cms vulnerable to cross site scripting in RSS feed widget
- Affected
- >=3.0.0 <3.8.4 · >=4.0.0 <4.4.4
- Fixed in
- 3.8.4, 4.4.4
Cross Site Scripting in CraftCMS
- Affected
- <3.7.68
- Fixed in
- 3.7.68
Craft CMS Stored Cross-site Scripting Injection Vulnerability
- Affected
- >=4.0.0-RC1 <4.3.7 · >=3.7.24 <3.7.64
- Fixed in
- 3.7.64, 4.3.7
Craft CMS discloses password hashes
- Affected
- >=3.0.0 <3.7.33
- Fixed in
- 3.7.33
Craft CMS Cross-site Scripting vulnerability
- Affected
- >=4.0.0-RC1 <4.2.1 · >=3.7.39 <3.7.51
- Fixed in
- 3.7.51, 4.2.1
Craft CMS Stored Cross-site Scripting in User Addresses Title
- Affected
- >=4.0.0-RC1 <4.2.1
- Fixed in
- 4.2.1
Craft CMS Cross site Scripting vulnerability
- Affected
- >=4.0.0-RC1 <4.2.1
- Fixed in
- 4.2.1
Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page
- Affected
- >=4.0.0-RC1 <4.2.1
- Fixed in
- 4.2.1
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts
- Affected
- >=3.7.0-beta.1 <3.7.55.2 · >=4.0.0-RC1 <4.2.1
- Fixed in
- 3.7.55.2, 4.2.1
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.1.33
- Fixed in
- 3.1.33
Craft CMS possibility of brute force attempts
- Affected
- <3.1.7
- Fixed in
- 3.1.7
Craft CMS XSS Vulnerability
- Affected
- <3.3.8
- Fixed in
- 3.3.8
Craft CMS XSS Vulnerability
- Affected
- <3.1.31
- Fixed in
- 3.1.31
Craft CMS XSS Vulnerability
- Affected
- <2.6.2974
- Fixed in
- 2.6.2974
Craft CMS XSS Vulnerability
- Affected
- <2.6.2976
- Fixed in
- 2.6.2976
Craft CMS subject to URL forgery
- Affected
- <2.6.2976
- Fixed in
- 2.6.2976
Craft CMS XSS Vulnerability
- Affected
- <2.6.2982
- Fixed in
- 2.6.2982
Craft CMS Cross-site Scripting (XSS) Vulnerability
- Affected
- <=3.0.25
- Fixed in
- No fix released
Craft CMS Vulnerable to Server-Side Template Injection
- Affected
- <=3.0.34
- Fixed in
- No fix released
Craft CMS Unauthorized View
- Affected
- <2.6.2976
- Fixed in
- 2.6.2976
Craft CMS PHP Code Injection Vulnerability
- Affected
- <=2.6.3000
- Fixed in
- No fix released
Improper account password reset in Craft CMS
- Affected
- <3.7.36
- Fixed in
- 3.7.36
XSS Injection Vulnerability
- Affected
- <3.7.29
- Fixed in
- 3.7.29
Cross-site Scripting in craftcms/cms
- Affected
- <3.7.29
- Fixed in
- 3.7.29
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.6.13
- Fixed in
- 3.6.13
CSV Injection Vulnerability
- Affected
- >=3.4.0 <3.7.14
- Fixed in
- 3.7.14
Craft CMS Remote Code Injection
- Affected
- <3.6.7
- Fixed in
- 3.6.7
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.6.0
- Fixed in
- 3.6.0
Which of your client projects still run an old craftcms/cms?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.